codexmate 0.0.38 → 0.0.40

package/cli.js

@@ -213,6 +213,7 @@ const CLAUDE_PROJECTS_DIR = path.join(os.homedir(), '.claude', 'projects');
 const CODEBUDDY_DIR = path.join(os.homedir(), '.codebuddy');
 const CODEBUDDY_PROJECTS_DIR = path.join(CODEBUDDY_DIR, 'projects');
 const CODEXMATE_DIR = path.join(os.homedir(), '.codexmate');
+const CODEXMATE_PREFERENCES_FILE = path.join(CODEXMATE_DIR, 'preferences.json');
 const CODEXMATE_SESSIONS_DIR = path.join(CODEXMATE_DIR, 'sessions');
 const CODEXMATE_DERIVED_SESSIONS_DIR = path.join(CODEXMATE_SESSIONS_DIR, 'derived');
 const CODEXMATE_DERIVED_CODEX_DIR = path.join(CODEXMATE_DERIVED_SESSIONS_DIR, 'codex');
@@ -717,6 +718,7 @@ function readConfig() {
 }
 
 function writeConfig(content) {
+    assertToolConfigWriteAllowed('codex');
     try {
         fs.writeFileSync(CONFIG_FILE, content, 'utf-8');
     } catch (e) {
@@ -734,6 +736,7 @@ function readModels() {
 }
 
 function writeModels(models) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(MODELS_FILE, JSON.stringify(models, null, 2), 'utf-8');
 }
 
@@ -747,10 +750,12 @@ function readCurrentModels() {
 }
 
 function writeCurrentModels(data) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(CURRENT_MODELS_FILE, JSON.stringify(data, null, 2), 'utf-8');
 }
 
 function updateAuthJson(apiKey) {
+    assertToolConfigWriteAllowed('codex');
     let authData = {};
     if (fs.existsSync(AUTH_FILE)) {
         try {
@@ -766,6 +771,141 @@ function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
 
+const TOOL_CONFIG_PERMISSION_TARGETS = new Set(['codex', 'claude']);
+const TOOL_CONFIG_PERMISSION_DEFAULTS = Object.freeze({ codex: false, claude: false });
+let toolConfigWriteGuardDepth = 0;
+
+function enterToolConfigWriteGuard() {
+    toolConfigWriteGuardDepth += 1;
+    let active = true;
+    return () => {
+        if (!active) return;
+        active = false;
+        toolConfigWriteGuardDepth = Math.max(0, toolConfigWriteGuardDepth - 1);
+    };
+}
+
+function isToolConfigWriteGuardActive() {
+    return toolConfigWriteGuardDepth > 0;
+}
+
+function normalizeToolConfigTarget(value) {
+    const target = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return TOOL_CONFIG_PERMISSION_TARGETS.has(target) ? target : '';
+}
+
+function normalizeToolConfigPermissions(value) {
+    const source = isPlainObject(value) ? value : {};
+    return {
+        codex: source.codex === true,
+        claude: source.claude === true
+    };
+}
+
+function readCodexmatePreferences() {
+    if (!fs.existsSync(CODEXMATE_PREFERENCES_FILE)) return {};
+    try {
+        const raw = fs.readFileSync(CODEXMATE_PREFERENCES_FILE, 'utf-8');
+        const parsed = raw && raw.trim() ? JSON.parse(raw) : {};
+        return isPlainObject(parsed) ? parsed : {};
+    } catch (_) {
+        return {};
+    }
+}
+
+function writeCodexmatePreferences(preferences) {
+    ensureDir(CODEXMATE_DIR);
+    writeJsonAtomic(CODEXMATE_PREFERENCES_FILE, isPlainObject(preferences) ? preferences : {});
+}
+
+function readToolConfigPermissions() {
+    const preferences = readCodexmatePreferences();
+    return normalizeToolConfigPermissions(preferences.toolConfigPermissions || TOOL_CONFIG_PERMISSION_DEFAULTS);
+}
+
+function isToolConfigWriteAllowed(target) {
+    const normalizedTarget = normalizeToolConfigTarget(target);
+    if (!normalizedTarget) return false;
+    return readToolConfigPermissions()[normalizedTarget] === true;
+}
+
+function buildToolConfigWriteDeniedPayload(target) {
+    const normalizedTarget = normalizeToolConfigTarget(target) || target || '';
+    return {
+        error: '当前为仅浏览，未修改配置。',
+        errorCode: 'tool-config-write-disabled',
+        target: normalizedTarget,
+        permissions: readToolConfigPermissions()
+    };
+}
+
+function assertToolConfigWriteAllowed(target) {
+    if (!isToolConfigWriteGuardActive()) return;
+    if (isToolConfigWriteAllowed(target)) return;
+    const payload = buildToolConfigWriteDeniedPayload(target);
+    const err = new Error(payload.error);
+    err.code = payload.errorCode;
+    err.target = payload.target;
+    throw err;
+}
+
+function getApiToolConfigWriteTarget(action) {
+    const name = typeof action === 'string' ? action.trim() : '';
+    if (!name) return '';
+    const codexWriteActions = new Set([
+        'apply-config-template',
+        'add-provider',
+        'update-provider',
+        'delete-provider',
+        'reset-config',
+        'add-model',
+        'delete-model',
+        'restore-codex-dir',
+        'import-config',
+        'import-auth-profile',
+        'switch-auth-profile',
+        'delete-auth-profile',
+        'proxy-enable-codex-default',
+        'proxy-apply-provider',
+        'local-bridge-toggle',
+        'local-bridge-set-excluded'
+    ]);
+    const claudeWriteActions = new Set([
+        'apply-claude-settings-raw',
+        'apply-claude-config',
+        'restore-claude-dir',
+        'claude-local-bridge-toggle',
+        'claude-local-bridge-set-excluded',
+        'claude-local-bridge-sync-providers'
+    ]);
+    if (codexWriteActions.has(name)) return 'codex';
+    if (claudeWriteActions.has(name)) return 'claude';
+    return '';
+}
+
+function setToolConfigPermission(params = {}) {
+    const target = normalizeToolConfigTarget(params && params.target);
+    if (!target) return { error: '未知配置对象' };
+    const preferences = readCodexmatePreferences();
+    const current = normalizeToolConfigPermissions(preferences.toolConfigPermissions || TOOL_CONFIG_PERMISSION_DEFAULTS);
+    current[target] = params && params.allowWrite === true;
+    preferences.toolConfigPermissions = current;
+    writeCodexmatePreferences(preferences);
+
+    let bootstrapNotice = '';
+    if (target === 'codex' && current.codex) {
+        const bootstrap = ensureManagedConfigBootstrap({ allowWrite: true });
+        bootstrapNotice = bootstrap && bootstrap.notice ? bootstrap.notice : '';
+    }
+
+    return {
+        success: true,
+        target,
+        permissions: current,
+        bootstrapNotice
+    };
+}
+
 const PROVIDER_CONFIG_KEYS = new Set([
     'name',
     'base_url',
@@ -2081,12 +2221,22 @@ function addProviderToConfig(params = {}) {
     const name = typeof params.name === 'string' ? params.name.trim() : '';
     const url = typeof params.url === 'string' ? params.url.trim() : '';
     const key = typeof params.key === 'string' ? params.key.trim() : '';
+    const requireModel = !!params.requireModel;
+    const fallbackModel = (() => {
+        if (requireModel) return '';
+        const list = readModels();
+        return Array.isArray(list) && typeof list[0] === 'string' ? list[0].trim() : '';
+    })();
+    const model = typeof params.model === 'string' && params.model.trim()
+        ? params.model.trim()
+        : fallbackModel;
     const useTransform = !!params.useTransform;
     const allowManaged = !!params.allowManaged;
     const normalizedUrl = normalizeBaseUrl(url);
 
     if (!name) return { error: '名称不能为空' };
     if (!url) return { error: 'URL 不能为空' };
+    if (!model) return { error: '模型名称不能为空' };
     if (!isValidProviderName(name)) {
         return { error: '名称仅支持字母/数字/._-' };
     }
@@ -2163,6 +2313,7 @@ function addProviderToConfig(params = {}) {
         `wire_api = "responses"`,
         `requires_openai_auth = ${requiresOpenaiAuth ? 'true' : 'false'}`,
         `preferred_auth_method = "${safeKey}"`,
+        `models = [{ id = "${escapeTomlBasicString(model)}", name = "${escapeTomlBasicString(model)}" }]`,
         ...extraLines,
         `request_max_retries = 4`,
         `stream_max_retries = 10`,
@@ -2173,6 +2324,13 @@ function addProviderToConfig(params = {}) {
 
     try {
         writeConfig(newContent);
+        const models = readModels();
+        if (!models.includes(model)) {
+            writeModels([...models, model]);
+        }
+        const currentModels = readCurrentModels();
+        currentModels[name] = model;
+        writeCurrentModels(currentModels);
     } catch (e) {
         return { error: `写入配置失败: ${e.message}` };
     }
@@ -5525,6 +5683,7 @@ function readLocalBridgeSettings() {
 }
 
 function writeLocalBridgeSettings(settings) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(LOCAL_BRIDGE_SETTINGS_FILE, JSON.stringify(settings, null, 2), 'utf-8');
 }
 
@@ -5623,6 +5782,7 @@ function readClaudeLocalBridgeSettings() {
 }
 
 function writeClaudeLocalBridgeSettings(settings) {
+    assertToolConfigWriteAllowed('claude');
     fs.writeFileSync(CLAUDE_LOCAL_BRIDGE_SETTINGS_FILE, JSON.stringify(settings, null, 2), 'utf-8');
 }
 
@@ -5637,6 +5797,7 @@ function readClaudeLocalProvidersFile() {
 }
 
 function writeClaudeLocalProvidersFile(data) {
+    assertToolConfigWriteAllowed('claude');
     ensureDir(CONFIG_DIR);
     fs.writeFileSync(CLAUDE_LOCAL_PROVIDERS_FILE, JSON.stringify(data, null, 2), 'utf-8');
 }
@@ -5651,6 +5812,7 @@ function syncClaudeProvidersToBridgeFile() {
 }
 
 function toggleClaudeLocalBridge(params = {}) {
+    assertToolConfigWriteAllowed('claude');
     const enable = !!params.enable;
     const settings = readClaudeLocalBridgeSettings();
 
@@ -9159,6 +9321,7 @@ function maskKey(key) {
 
 // 应用到 Claude Code settings.json（跨平台）
 function applyToClaudeSettings(config = {}) {
+    assertToolConfigWriteAllowed('claude');
     try {
         const apiKey = (config.apiKey || '').trim();
         if (!apiKey) {
@@ -9258,6 +9421,7 @@ function readClaudeSettingsRaw() {
 }
 
 function applyClaudeSettingsRaw(params = {}) {
+    assertToolConfigWriteAllowed('claude');
     const content = typeof params.content === 'string' ? params.content : '';
     if (!content.trim()) {
         return { error: '内容不能为空' };
@@ -10751,14 +10915,28 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
             });
             req.on('end', async () => {
                 if (bodyTooLarge) return;
+                let leaveToolConfigWriteGuard = null;
                 try {
                     const { action, params } = JSON.parse(body || '{}');
+                    leaveToolConfigWriteGuard = typeof enterToolConfigWriteGuard === 'function'
+                        ? enterToolConfigWriteGuard()
+                        : () => {};
                     let result;
 
-                    switch (action) {
+                    const guardedToolConfigTarget = getApiToolConfigWriteTarget(action);
+                    if (guardedToolConfigTarget && !isToolConfigWriteAllowed(guardedToolConfigTarget)) {
+                        result = buildToolConfigWriteDeniedPayload(guardedToolConfigTarget);
+                    } else {
+                        switch (action) {
                         case 'health-check':
                             result = { ok: true };
                             break;
+                        case 'get-tool-config-permissions':
+                            result = { permissions: readToolConfigPermissions() };
+                            break;
+                        case 'set-tool-config-permission':
+                            result = setToolConfigPermission(params || {});
+                            break;
                         case 'status': {
                             const statusConfigResult = readConfigOrVirtualDefault();
                             const config = statusConfigResult.config;
@@ -10797,7 +10975,8 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                                 configReady: !statusConfigResult.isVirtual,
                                 configErrorType: statusConfigResult.errorType || '',
                                 configNotice: statusConfigResult.reason || '',
-                                initNotice: consumeInitNotice()
+                                initNotice: consumeInitNotice(),
+                                toolConfigPermissions: readToolConfigPermissions()
                             };
                             break;
                         }
@@ -10866,7 +11045,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                             result = buildConfigTemplateDiff(params || {});
                             break;
                         case 'add-provider':
-                            result = addProviderToConfig(params || {});
+                            result = addProviderToConfig({ ...(params || {}), requireModel: true });
                             break;
                         case 'update-provider':
                             result = updateProviderInConfig(params || {});
@@ -11437,6 +11616,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                             break;
                         default:
                             result = { error: '未知操作' };
+                        }
                     }
 
                     const responseBody = JSON.stringify(result, null, 2);
@@ -11445,7 +11625,9 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                         'Content-Length': Buffer.byteLength(responseBody, 'utf-8')
                     });
                     res.end(responseBody, 'utf-8');
+                    if (leaveToolConfigWriteGuard) leaveToolConfigWriteGuard();
                 } catch (e) {
+                    if (leaveToolConfigWriteGuard) leaveToolConfigWriteGuard();
                     const errorBody = JSON.stringify({ error: e.message }, null, 2);
                     res.writeHead(500, {
                         'Content-Type': 'application/json; charset=utf-8',
@@ -16044,7 +16226,10 @@ async function main() {
     const args = process.argv.slice(2);
     const command = args[0];
     const isMcpCommand = command === 'mcp';
-    const bootstrap = ensureManagedConfigBootstrap();
+    const shouldGateInitialBootstrap = command === 'run' || isMcpCommand;
+    const bootstrap = ensureManagedConfigBootstrap({
+        allowWrite: shouldGateInitialBootstrap ? isToolConfigWriteAllowed('codex') : true
+    });
     if (bootstrap && bootstrap.notice) {
         // MCP stdio transport requires stdout to be protocol-clean.
         if (!isMcpCommand) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexmate",
-  "version": "0.0.38",
+  "version": "0.0.40",
   "description": "Codex/Claude Code/OpenClaw 配置、会话与任务编排 CLI + Web 工具",
   "main": "cli.js",
   "bin": {

package/plugins/prompt-templates/computed.mjs

@@ -102,18 +102,75 @@ function renderTemplate(templateText, values = {}) {
     });
 }
 
+function translate(t, key, fallback, params = null) {
+    if (typeof t !== 'function') return fallback;
+    const translated = t(key, params);
+    return translated === key ? fallback : translated;
+}
+
+function localizePluginMeta(meta, t) {
+    const safe = meta && typeof meta === 'object' ? meta : {};
+    const titleKey = typeof safe.titleKey === 'string' ? safe.titleKey : '';
+    const descriptionKey = typeof safe.descriptionKey === 'string' ? safe.descriptionKey : '';
+    const statusLabelKey = typeof safe.statusLabelKey === 'string' ? safe.statusLabelKey : '';
+    return {
+        ...safe,
+        title: titleKey ? translate(t, titleKey, safe.title || '') : (safe.title || ''),
+        description: descriptionKey ? translate(t, descriptionKey, safe.description || '') : (safe.description || ''),
+        statusLabel: statusLabelKey ? translate(t, statusLabelKey, safe.statusLabel || '') : (safe.statusLabel || '')
+    };
+}
+
+const BUILTIN_TEMPLATE_I18N = Object.freeze({
+    builtin_comment_polish: Object.freeze({
+        nameKey: 'plugins.builtin.commentPolish.name',
+        descKey: 'plugins.builtin.commentPolish.desc',
+        lineKey: 'plugins.builtin.commentPolish.line1',
+        fallbackName: '代码注释润色',
+        fallbackDesc: '轻微收敛以下代码注释 {{code}}',
+        fallbackLine: '轻微收敛以下代码注释',
+        vars: ['{{code}}']
+    }),
+    builtin_rule_ack: Object.freeze({
+        nameKey: 'plugins.builtin.ruleAck.name',
+        descKey: 'plugins.builtin.ruleAck.desc',
+        lineKey: 'plugins.builtin.ruleAck.line1',
+        fallbackName: '规则确认回复',
+        fallbackDesc: '请根据【{{rule}}】，收到请回复',
+        fallbackLine: '请根据【{{rule}}】，收到请回复',
+        vars: []
+    })
+});
+
+function localizeBuiltinPromptTemplate(item, t) {
+    const safe = item && typeof item === 'object' ? item : {};
+    if (safe.isBuiltin !== true) return safe;
+    const spec = BUILTIN_TEMPLATE_I18N[safe.id];
+    if (!spec) return safe;
+    const line = translate(t, spec.lineKey, spec.fallbackLine);
+    return {
+        ...safe,
+        name: translate(t, spec.nameKey, spec.fallbackName),
+        description: translate(t, spec.descKey, spec.fallbackDesc),
+        template: spec.vars && spec.vars.length ? [line, '', ...spec.vars].join('\n') : line
+    };
+}
+
 import { pluginsRegistry } from '../registry.mjs';
 
 export function createPluginsComputed() {
     return {
         pluginsCatalog() {
-            return pluginsRegistry.map((entry) => entry && entry.meta).filter(Boolean);
+            return pluginsRegistry
+                .map((entry) => entry && entry.meta)
+                .filter(Boolean)
+                .map((meta) => localizePluginMeta(meta, this.t));
         },
 
         pluginsActiveMeta() {
             const id = typeof this.pluginsActiveId === 'string' ? this.pluginsActiveId.trim() : '';
             const entry = pluginsRegistry.find((item) => item && item.id === id) || null;
-            return entry && entry.meta ? entry.meta : null;
+            return entry && entry.meta ? localizePluginMeta(entry.meta, this.t) : null;
         },
 
         pluginsActiveAttribution() {
@@ -138,6 +195,7 @@ export function createPluginsComputed() {
             const list = Array.isArray(this.promptTemplatesListRaw) ? this.promptTemplatesListRaw : [];
             return list
                 .map((item) => normalizePromptTemplateEntry(item))
+                .map((item) => localizeBuiltinPromptTemplate(item, this.t))
                 .filter((item) => item.id && item.name)
                 .map((item) => {
                     const vars = parseTemplateVariables(item.template);
@@ -178,7 +236,7 @@ export function createPluginsComputed() {
             const id = typeof draft.id === 'string' ? draft.id : '';
             const name = typeof draft.name === 'string' ? draft.name : '';
             if (!id && !name) return null;
-            return normalizePromptTemplateEntry(draft);
+            return localizeBuiltinPromptTemplate(normalizePromptTemplateEntry(draft), this.t);
         },
 
         promptTemplateVars() {

package/plugins/prompt-templates/manifest.mjs

@@ -3,8 +3,11 @@ import { pluginOwnership } from './ownership.mjs';
 const baseMeta = {
     id: 'prompt-templates',
     title: 'Prompt Templates',
+    titleKey: 'plugins.catalog.promptTemplates.title',
     description: 'Standardized, template-driven prompts with variables and copy/export helpers.',
+    descriptionKey: 'plugins.catalog.promptTemplates.description',
     statusLabel: 'standard',
+    statusLabelKey: 'plugins.status.standard',
     tone: 'configured'
 };
 

package/web-ui/app.js

@@ -62,11 +62,13 @@ document.addEventListener('DOMContentLoaded', () => {
                 messageType: '',
                 showAddModal: false,
                 showEditModal: false,
+                showAddProviderKey: false,
                 showEditProviderKey: false,
                 showModelModal: false,
                 showModelListModal: false,
                 showClaudeConfigModal: false,
                 showEditConfigModal: false,
+                showAddClaudeConfigKey: false,
                 showEditClaudeConfigKey: false,
                 showOpenclawConfigModal: false,
                 showConfigTemplateModal: false,
@@ -268,7 +270,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 installRegistryPreset: 'default',
                 installRegistryCustom: '',
                 installStatusTargets: null,
-                newProvider: { name: '', url: '', key: '', useTransform: false, _suggestedModel: '' },
+                newProvider: { name: '', url: '', key: '', model: '', useTransform: false },
                 resetConfigLoading: false,
                 editingProvider: { name: '', url: '', key: '', readOnly: false, nonEditable: false },
                 newModelName: '',
@@ -293,7 +295,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 currentOpenclawConfig: '',
                 openclawConfigs: {
                     '默认配置': {
-                        content: DEFAULT_OPENCLAW_TEMPLATE
+                        content: DEFAULT_OPENCLAW_TEMPLATE,
+                        isDefault: true
                     }
                 },
                 openclawEditing: { name: '', content: '', lockName: false },
@@ -343,6 +346,11 @@ document.addEventListener('DOMContentLoaded', () => {
                     overrideModels: true,
                     showKey: false
                 },
+                openclawAccordionStep: 1,
+                openclawValidation: {
+                    providerName: { valid: true, message: '' },
+                    modelId: { valid: true, message: '' }
+                },
                 openclawAgentsList: [],
                 openclawProviders: [],
                 openclawMissingProviders: [],
@@ -358,6 +366,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 codexDownloadProgress: 0,
                 codexDownloadTimer: null,
                 settingsTab: 'general',
+                toolConfigPermissions: { codex: false, claude: false },
+                toolConfigPermissionSaving: { codex: false, claude: false },
                 sessionTrashEnabled: true,
                 sessionTrashItems: [],
                 sessionTrashVisibleCount: SESSION_TRASH_PAGE_SIZE,
@@ -567,7 +577,8 @@ document.addEventListener('DOMContentLoaded', () => {
                         : { content: DEFAULT_OPENCLAW_TEMPLATE };
                 const normalized = {
                     '默认配置': {
-                        content: typeof defaultEntry.content === 'string' ? defaultEntry.content : DEFAULT_OPENCLAW_TEMPLATE
+                        content: typeof defaultEntry.content === 'string' ? defaultEntry.content : DEFAULT_OPENCLAW_TEMPLATE,
+                        isDefault: true
                     }
                 };
                 for (const [name, value] of Object.entries(source)) {